MindsDB Eval Injection vulnerability
An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a database created with the ChromaDB engine, the code will be passed to an eval function and executed on the server.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-45848US | high8.8 | — | ||
An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specia… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/mindsdb/mindsdbPACKAGE
- https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-78.yamlWEB
- https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdbWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-45848ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan